domainkit 0.1.0 → 0.2.0

package/dist/verify-BjrR_4NF.mjs

@@ -1,1401 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { D as parse$1, O as Error$3, T as decode$4, _ as equals, b as Service, h as decode$5, m as data, s as Observed, u as Schema$6, w as Schema$5, y as Error$4 } from "./dns-record-C_KwGPLf.mjs";
-import { a as toAsync$2, m as Service$3, n as Service$5, o as Service$4, t as Error$5, u as Service$2, v as Service$1 } from "./resolver-tEXpKxmH.mjs";
-import { c as Value } from "./client-BnD7QLRF.mjs";
-import { Cause, Clock, Crypto, Effect, Layer, PlatformError, Schema, SchemaIssue, SchemaTransformation } from "effect";
-import * as oauth from "oauth4webapi";
-import { getDomain } from "tldts";
-import * as DnsPacket from "@leichtgewicht/dns-packet";
-//#region package.json
-var version = "0.1.0";
-//#endregion
-//#region src/auth/connection.ts
-var connection_exports = /* @__PURE__ */ __exportAll({
-	AuthorizationError: () => AuthorizationError$1,
-	Grant: () => Grant,
-	Schema: () => Schema$4,
-	assertGrant: () => assertGrant,
-	decode: () => decode$3,
-	encode: () => encode$2,
-	validate: () => validate$3
-});
-const Grant = Schema.TaggedUnion({
-	account: {},
-	domains: { domains: Schema.Array(Schema$5) }
-});
-/** An owner-scoped grant bound to one provider authorization. */
-const Schema$4 = Schema.Struct({
-	authorizationId: Schema.String,
-	createdAt: Schema.DateFromString,
-	grant: Grant,
-	id: Schema.String,
-	ownerId: Schema.String
-});
-const decode$3 = Effect.fn("Connection.decode")((input) => Schema.decodeUnknownEffect(Schema$4)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
-const validate$3 = Effect.fn("Connection.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$4))(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
-const encode$2 = Schema.encodeSync(Schema$4);
-var AuthorizationError$1 = class extends Schema.TaggedError()("AuthorizationError", { message: Schema.String }) {};
-function assertGrant(connection, authorization, request) {
-	if (connection.authorizationId !== authorization.id || authorization.providerId !== request.providerId) throw new AuthorizationError$1({ message: "Connection does not grant this provider account" });
-	if (authorization.expiresAt !== null) {
-		if (Number.isNaN(authorization.expiresAt.getTime())) throw new AuthorizationError$1({ message: "Connection expiration is invalid" });
-		if (authorization.expiresAt <= (request.now ?? /* @__PURE__ */ new Date())) throw new AuthorizationError$1({ message: "Connection has expired" });
-	}
-	if (!authorization.capabilities.includes(request.capability)) throw new AuthorizationError$1({ message: `Connection lacks the ${request.capability} capability` });
-	let domain;
-	try {
-		domain = parse$1(request.domain);
-	} catch (cause) {
-		if (cause instanceof Error$3) throw cause;
-		throw new Error$3({ message: cause instanceof Error ? cause.message : String(cause) });
-	}
-	if (connection.grant._tag === "domains" && !connection.grant.domains.includes(domain)) throw new AuthorizationError$1({ message: "Connection does not grant this domain" });
-	return domain;
-}
-//#endregion
-//#region src/auth/connection-lifecycle.ts
-var connection_lifecycle_exports = /* @__PURE__ */ __exportAll({
-	Error: () => Error$2,
-	detach: () => detach,
-	updateGrant: () => updateGrant
-});
-var Error$2 = class extends Schema.TaggedError()("ConnectionLifecycleError", { message: Schema.String }) {};
-/** Replace the grant on an owner binding after the host has obtained explicit consent. */
-const updateGrant = Effect.fn("ConnectionLifecycle.updateGrant")(function* (input) {
-	const connectionStore = yield* Service$1;
-	const connection = yield* validate$3({
-		...input.connection,
-		grant: input.grant
-	});
-	yield* connectionStore.put(connection);
-	return connection;
-});
-/**
-* Detach one owner binding. The final binding invokes provider revocation before deleting local
-* credential and authorization state. The callback keeps provider-specific revocation outside the
-* portable authorization model.
-*/
-function detach(input) {
-	return Effect.gen(function* () {
-		const authorizationStore = yield* Service$2;
-		const connectionStore = yield* Service$1;
-		const credentialStore = yield* Service$3;
-		const connection = yield* connectionStore.get(input.connectionId);
-		if (connection === null) return yield* new Error$2({ message: "Connection binding does not exist" });
-		const remainingBindings = (yield* connectionStore.listByAuthorizationId(connection.authorizationId)).filter(({ id }) => id !== connection.id);
-		if (remainingBindings.length > 0) {
-			yield* connectionStore.delete(connection.id);
-			return {
-				connection,
-				remainingBindings: remainingBindings.length,
-				revokedAuthorization: false
-			};
-		}
-		const authorization = yield* authorizationStore.get(connection.authorizationId);
-		if (authorization === null) {
-			yield* credentialStore.delete(connection.authorizationId);
-			yield* connectionStore.delete(connection.id);
-			return {
-				connection,
-				remainingBindings: 0,
-				revokedAuthorization: true
-			};
-		}
-		yield* input.revokeAuthorization(authorization);
-		yield* credentialStore.delete(authorization.id);
-		yield* authorizationStore.delete(authorization.id);
-		yield* connectionStore.delete(connection.id);
-		return {
-			connection,
-			remainingBindings: 0,
-			revokedAuthorization: true
-		};
-	});
-}
-//#endregion
-//#region src/auth/authorization.ts
-var authorization_exports = /* @__PURE__ */ __exportAll({
-	Capability: () => Capability,
-	Schema: () => Schema$3,
-	decode: () => decode$2,
-	encode: () => encode$1,
-	validate: () => validate$2
-});
-const Capability = Schema.Literals(["dns:read", "dns:write"]);
-/** A provider credential authorization shared by one or more owner connections. */
-const Schema$3 = Schema.Struct({
-	accountId: Schema.String,
-	capabilities: Schema.Array(Capability),
-	createdAt: Schema.DateFromString,
-	expiresAt: Schema.NullOr(Schema.DateFromString),
-	id: Schema.String,
-	kind: Schema.Literals(["oauth2", "token"]),
-	providerId: Schema.String,
-	scopes: Schema.Array(Schema.String),
-	subjectId: Schema.String
-});
-const decode$2 = Effect.fn("ProviderAuthorization.decode")((input) => Schema.decodeUnknownEffect(Schema$3)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
-const validate$2 = Effect.fn("ProviderAuthorization.validate")((input) => Schema.decodeUnknownEffect(Schema.toType(Schema$3))(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
-const encode$1 = Schema.encodeSync(Schema$3);
-//#endregion
-//#region src/plan/canonical-json.ts
-var canonical_json_exports = /* @__PURE__ */ __exportAll({
-	CryptoError: () => CryptoError,
-	sha256Encoded: () => sha256Encoded,
-	sha256Json: () => sha256Json,
-	sha256Text: () => sha256Text,
-	stringify: () => stringify,
-	webCryptoLayer: () => webCryptoLayer
-});
-var CryptoError = class extends Schema.TaggedError()("CryptoError", { message: Schema.String }) {};
-/** Deterministic JSON serialization for already schema-encoded protocol values. */
-function stringify(value) {
-	if (value === null || typeof value !== "object") {
-		const encoded = JSON.stringify(value);
-		if (encoded === void 0) throw new TypeError("Value is not representable as JSON");
-		return encoded;
-	}
-	if (isJsonArray(value)) return `[${value.map(stringify).join(",")}]`;
-	return `{${Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${stringify(entry)}`).join(",")}}`;
-}
-function isJsonArray(value) {
-	return Array.isArray(value);
-}
-const sha256Text = Effect.fn("Digest.sha256Text")(function* (value) {
-	return [...yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-});
-const sha256Json = Effect.fn("Digest.sha256Json")((value) => Effect.try({
-	try: () => stringify(value),
-	catch: (cause) => new CryptoError({ message: cause instanceof Error ? cause.message : String(cause) })
-}).pipe(Effect.flatMap(sha256Text)));
-function sha256EncodedProgram(schema, value) {
-	return Schema.encodeEffect(schema)(value).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(Schema.decodeUnknownEffect(Schema.Json)), Effect.mapError((cause) => new CryptoError({ message: cause.message })), Effect.flatMap(sha256Json));
-}
-const sha256Encoded = Effect.fn("Digest.sha256Encoded")(sha256EncodedProgram);
-/** Portable Web Crypto implementation for hosts that want a ready-made Layer. */
-const webCryptoLayer = Layer.succeed(Crypto.Crypto, Crypto.make({
-	randomBytes: (size) => crypto.getRandomValues(new Uint8Array(size)),
-	digest: (algorithm, data) => Effect.tryPromise({
-		try: async () => {
-			const bytes = new Uint8Array(data.byteLength);
-			bytes.set(data);
-			return new Uint8Array(await crypto.subtle.digest(algorithm, bytes.buffer));
-		},
-		catch: (cause) => PlatformError.systemError({
-			_tag: "Unknown",
-			module: "WebCrypto",
-			method: "digest",
-			cause
-		})
-	})
-}));
-//#endregion
-//#region src/auth/oauth.ts
-var oauth_exports = /* @__PURE__ */ __exportAll({
-	begin: () => begin,
-	complete: () => complete,
-	refresh: () => refresh,
-	revoke: () => revoke
-});
-function beginProgram(input) {
-	return Effect.gen(function* () {
-		const stateStore = yield* Service$4;
-		const cryptoService = yield* Crypto.Crypto;
-		const now = yield* Clock.currentTimeMillis;
-		const state = base64Url(yield* cryptoBytes(cryptoService, 32));
-		const codeVerifier = base64Url(yield* cryptoBytes(cryptoService, 32));
-		const challenge = base64Url(yield* cryptoService.digest("SHA-256", new TextEncoder().encode(codeVerifier)).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message }))));
-		const stateHash = yield* sha256Text(state);
-		const authorizationUrl = new URL(input.method.authorizationServer.authorization_endpoint);
-		authorizationUrl.search = new URLSearchParams({
-			client_id: input.client.clientId,
-			code_challenge: challenge,
-			code_challenge_method: "S256",
-			redirect_uri: input.redirectUri,
-			response_type: "code",
-			scope: input.method.scopes.join(" "),
-			state
-		}).toString();
-		yield* stateStore.put({
-			clientId: input.client.clientId,
-			codeVerifier: Value.from(codeVerifier),
-			expiresAt: new Date(now + (input.ttlMs ?? 6e5)),
-			grant: input.grant,
-			method: input.method,
-			ownerId: input.ownerId,
-			redirectUri: input.redirectUri,
-			stateHash,
-			subjectId: input.subjectId
-		});
-		return { authorizationUrl };
-	});
-}
-function completeProgram(input) {
-	return Effect.gen(function* () {
-		const stateStore = yield* Service$4;
-		const authorizationStore = yield* Service$2;
-		const connectionStore = yield* Service$1;
-		const credentialStore = yield* Service$3;
-		const cryptoService = yield* Crypto.Crypto;
-		const state = input.callbackUrl.searchParams.get("state");
-		if (state === null) return yield* new AuthorizationError$1({ message: "OAuth callback is missing state" });
-		const now = yield* Clock.currentTimeMillis;
-		const continuation = yield* stateStore.consume(yield* sha256Text(state), new Date(now));
-		if (continuation === null) return yield* new AuthorizationError$1({ message: "OAuth continuation is expired, unknown, or already used" });
-		if (continuation.clientId !== input.client.clientId) return yield* new AuthorizationError$1({ message: "OAuth client does not match the continuation" });
-		const as = continuation.method.authorizationServer;
-		const client = { client_id: continuation.clientId };
-		const authentication = yield* effectClientAuthentication(continuation.method, input.client);
-		const tokens = yield* providerRequest(input.providerId, async (signal) => {
-			const callbackParameters = oauth.validateAuthResponse(as, client, input.callbackUrl, state);
-			const response = await oauth.authorizationCodeGrantRequest(as, client, authentication, callbackParameters, continuation.redirectUri, continuation.codeVerifier.expose(), requestOptions(input.fetch, signal));
-			return oauth.processAuthorizationCodeResponse(as, client, response);
-		});
-		const accessToken = Value.from(tokens.access_token);
-		const subject = yield* input.resolveSubject(tokens, accessToken);
-		const existingAuthorization = yield* authorizationStore.findByProviderAccount(input.providerId, subject.accountId);
-		const authorizationId = existingAuthorization?.id ?? (yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message }))));
-		const authorization = yield* validate$2({
-			accountId: subject.accountId,
-			capabilities: [...continuation.method.capabilities],
-			createdAt: existingAuthorization?.createdAt ?? new Date(now),
-			expiresAt: subject.expiresAt,
-			id: authorizationId,
-			kind: "oauth2",
-			providerId: input.providerId,
-			scopes: (tokens.scope ?? continuation.method.scopes.join(" ")).split(" ").filter(Boolean),
-			subjectId: continuation.subjectId
-		});
-		const existingConnection = yield* connectionStore.find(continuation.ownerId, authorization.id);
-		const connection = yield* validate$3({
-			authorizationId: authorization.id,
-			createdAt: existingConnection?.createdAt ?? new Date(now),
-			grant: continuation.grant,
-			id: existingConnection?.id ?? (yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))),
-			ownerId: continuation.ownerId
-		});
-		yield* credentialStore.put(authorization.id, {
-			accessToken,
-			refreshToken: tokens.refresh_token === void 0 ? null : Value.from(tokens.refresh_token),
-			tokenType: tokens.token_type
-		});
-		yield* authorizationStore.put(authorization);
-		yield* connectionStore.put(connection);
-		return {
-			authorization,
-			connection
-		};
-	});
-}
-function refreshProgram(input) {
-	return Effect.gen(function* () {
-		const credentialStore = yield* Service$3;
-		const credential = yield* requireCredential(input.authorization.id, credentialStore);
-		const refreshToken = credential.refreshToken;
-		if (refreshToken === null) return yield* new AuthorizationError$1({ message: "Connection has no refresh token" });
-		const as = input.method.authorizationServer;
-		const client = { client_id: input.client.clientId };
-		const authentication = yield* effectClientAuthentication(input.method, input.client);
-		const tokens = yield* providerRequest(input.authorization.providerId, async (signal) => {
-			const response = await oauth.refreshTokenGrantRequest(as, client, authentication, refreshToken.expose(), requestOptions(input.fetch, signal));
-			return oauth.processRefreshTokenResponse(as, client, response);
-		});
-		yield* credentialStore.put(input.authorization.id, {
-			accessToken: Value.from(tokens.access_token),
-			refreshToken: tokens.refresh_token === void 0 ? credential.refreshToken : Value.from(tokens.refresh_token),
-			tokenType: tokens.token_type
-		});
-	});
-}
-function revokeProgram(input) {
-	return Effect.gen(function* () {
-		if (input.method.authorizationServer.revocation_endpoint === void 0) return yield* new AuthorizationError$1({ message: "Provider does not advertise token revocation" });
-		const credentialStore = yield* Service$3;
-		const credential = yield* requireCredential(input.authorization.id, credentialStore);
-		const as = input.method.authorizationServer;
-		const authentication = yield* effectClientAuthentication(input.method, input.client);
-		yield* providerRequest(input.authorization.providerId, async (signal) => {
-			const response = await oauth.revocationRequest(as, { client_id: input.client.clientId }, authentication, credential.accessToken.expose(), requestOptions(input.fetch, signal));
-			await oauth.processRevocationResponse(response);
-		});
-		yield* credentialStore.delete(input.authorization.id);
-	});
-}
-function effectClientAuthentication(method, client) {
-	return Effect.try({
-		try: () => clientAuthentication(method, client),
-		catch: (cause) => cause instanceof Error$3 ? cause : new Error$3({ message: "OAuth client authentication is invalid" })
-	});
-}
-function clientAuthentication(method, client) {
-	switch (method.clientAuth) {
-		case "none": return oauth.None();
-		case "client_secret_basic":
-			if (client.clientSecret === void 0) throw new Error$3({ message: "Client secret is required" });
-			return oauth.ClientSecretBasic(client.clientSecret.expose());
-		case "client_secret_post":
-			if (client.clientSecret === void 0) throw new Error$3({ message: "Client secret is required" });
-			return oauth.ClientSecretPost(client.clientSecret.expose());
-	}
-}
-function requestOptions(fetchImplementation, signal) {
-	return fetchImplementation === void 0 ? { signal } : {
-		signal,
-		[oauth.customFetch]: (url, options) => fetchImplementation(url, {
-			...options,
-			body: options.body
-		})
-	};
-}
-function requireCredential(connectionId, store) {
-	return store.get(connectionId).pipe(Effect.flatMap((credential) => credential === null ? Effect.fail(new AuthorizationError$1({ message: "Connection credentials are unavailable" })) : Effect.succeed(credential)));
-}
-function providerRequest(providerId, request) {
-	return Effect.tryPromise({
-		try: request,
-		catch: (cause) => cause instanceof AuthorizationError$1 || cause instanceof Error$3 ? cause : new Error$4({
-			cause,
-			message: safeOAuthMessage(cause),
-			operation: "oauthRequest",
-			providerId
-		})
-	});
-}
-function cryptoBytes(cryptoService, size) {
-	return cryptoService.randomBytes(size).pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })));
-}
-function base64Url(bytes) {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-}
-function safeOAuthMessage(cause) {
-	return cause instanceof Error ? cause.name : "OAuth provider request failed";
-}
-const begin = Effect.fn("OAuth.begin")(beginProgram);
-const complete = Effect.fn("OAuth.complete")(completeProgram);
-const refresh = Effect.fn("OAuth.refresh")(refreshProgram);
-const revoke = Effect.fn("OAuth.revoke")(revokeProgram);
-//#endregion
-//#region src/auth/manifest.ts
-var manifest_exports = /* @__PURE__ */ __exportAll({
-	Method: () => Method,
-	Schema: () => Schema$2,
-	decode: () => decode$1
-});
-const Method = Schema.TaggedUnion({
-	integration: {
-		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
-		installUrl: Schema.String,
-		tokenEndpoint: Schema.String
-	},
-	oauth2: {
-		authorizationServer: Schema.Struct({
-			authorization_endpoint: Schema.String,
-			issuer: Schema.String,
-			revocation_endpoint: Schema.optionalKey(Schema.String),
-			token_endpoint: Schema.String
-		}),
-		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
-		clientAuth: Schema.Literals([
-			"none",
-			"client_secret_basic",
-			"client_secret_post"
-		]),
-		scopes: Schema.Array(Schema.String)
-	},
-	token: {
-		capabilities: Schema.Array(Schema.Literals(["dns:read", "dns:write"])),
-		instructionsUrl: Schema.String
-	}
-});
-const Schema$2 = Schema.Struct({
-	methods: Schema.Array(Method),
-	providerId: Schema.String
-});
-const decode$1 = Effect.fn("ProviderAuth.decode")((input) => Schema.decodeUnknownEffect(Schema$2)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
-//#endregion
-//#region src/auth/token.ts
-var token_exports = /* @__PURE__ */ __exportAll({ connect: () => connect });
-const connect = Effect.fn("TokenConnection.connect")(function* (input) {
-	const authorizationStore = yield* Service$2;
-	const connectionStore = yield* Service$1;
-	const credentialStore = yield* Service$3;
-	const cryptoService = yield* Crypto.Crypto;
-	const validation = yield* input.validate(input.token);
-	const createdAt = new Date(yield* Clock.currentTimeMillis);
-	const existingAuthorization = yield* authorizationStore.findByProviderAccount(input.providerId, validation.accountId);
-	const authorization = yield* validate$2({
-		accountId: validation.accountId,
-		capabilities: [...validation.capabilities],
-		createdAt: existingAuthorization?.createdAt ?? createdAt,
-		expiresAt: validation.expiresAt,
-		id: existingAuthorization?.id ?? (yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))),
-		kind: "token",
-		providerId: input.providerId,
-		scopes: [...validation.scopes],
-		subjectId: input.subjectId
-	});
-	const existingConnection = yield* connectionStore.find(input.ownerId, authorization.id);
-	const connection = yield* validate$3({
-		authorizationId: authorization.id,
-		createdAt: existingConnection?.createdAt ?? createdAt,
-		grant: input.grant,
-		id: existingConnection?.id ?? (yield* cryptoService.randomUUIDv4.pipe(Effect.mapError((cause) => new CryptoError({ message: cause.message })))),
-		ownerId: input.ownerId
-	});
-	yield* credentialStore.put(authorization.id, {
-		accessToken: input.token,
-		refreshToken: null,
-		tokenType: "bearer"
-	});
-	yield* authorizationStore.put(authorization);
-	yield* connectionStore.put(connection);
-	return {
-		authorization,
-		connection
-	};
-});
-//#endregion
-//#region src/discovery/zones.ts
-var zones_exports = /* @__PURE__ */ __exportAll({ candidates: () => candidates });
-function candidates(input) {
-	const domain = parse$1(input);
-	const registrable = getDomain(domain, { allowPrivateDomains: true });
-	if (registrable === null) throw new Error$3({ message: "Domain does not have a registrable DNS zone" });
-	const labels = domain.split(".");
-	const registrableLabels = registrable.split(".").length;
-	const values = [];
-	for (let index = 0; index <= labels.length - registrableLabels; index += 1) values.push(parse$1(labels.slice(index).join(".")));
-	return values;
-}
-//#endregion
-//#region src/discovery/selection.ts
-var selection_exports = /* @__PURE__ */ __exportAll({
-	Evidence: () => Evidence,
-	Selection: () => Selection,
-	select: () => select
-});
-const Evidence = Schema.Struct({
-	accountId: Schema.String,
-	connectionId: Schema.String,
-	decisiveNameserverMatch: Schema.Boolean,
-	matchedNameservers: Schema.Array(Schema$5),
-	providerId: Schema.String,
-	zone: Schema$5
-});
-const Selection = Schema.TaggedUnion({
-	selected: {
-		candidate: Evidence,
-		evidence: Schema.Array(Evidence),
-		reason: Schema.Literals(["explicit", "unique-nameserver-match"])
-	},
-	manual: {
-		evidence: Schema.Array(Evidence),
-		reason: Schema.Literals(["ambiguous", "unsupported"])
-	}
-});
-function select(input) {
-	const domain = parse$1(input.domain);
-	const zoneCandidates = new Set(candidates(domain));
-	const authoritative = nameserverSet(input.authoritativeNameservers);
-	const eligible = input.connectedZones.filter((connected) => {
-		if (!zoneCandidates.has(parse$1(connected.zone))) return false;
-		try {
-			assertGrant(connected.connection, connected.authorization, {
-				capability: "dns:read",
-				domain,
-				...input.now === void 0 ? {} : { now: input.now },
-				providerId: connected.providerId
-			});
-			return true;
-		} catch {
-			return false;
-		}
-	});
-	const evidence = eligible.map((connected) => evidenceFor(connected, authoritative));
-	if (input.explicit !== void 0) {
-		const explicitZone = parse$1(input.explicit.zone);
-		const index = eligible.findIndex((connected) => connected.providerId === input.explicit?.providerId && connected.authorization.accountId === input.explicit.accountId && parse$1(connected.zone) === explicitZone);
-		if (index < 0) throw new AuthorizationError$1({ message: "Explicit provider zone is not connected or granted" });
-		const candidate = evidence[index];
-		if (candidate === void 0) throw new Error("Eligible provider evidence is missing");
-		return {
-			_tag: "selected",
-			candidate,
-			evidence,
-			reason: "explicit"
-		};
-	}
-	const decisive = evidence.filter(({ decisiveNameserverMatch }) => decisiveNameserverMatch);
-	const candidate = decisive[0];
-	return decisive.length === 1 && candidate !== void 0 ? {
-		_tag: "selected",
-		candidate,
-		evidence,
-		reason: "unique-nameserver-match"
-	} : {
-		_tag: "manual",
-		evidence,
-		reason: decisive.length > 1 ? "ambiguous" : "unsupported"
-	};
-}
-function evidenceFor(connected, authoritative) {
-	const configured = new Set(nameserverSet(connected.nameservers));
-	const matchedNameservers = authoritative.filter((nameserver) => configured.has(nameserver));
-	return {
-		accountId: connected.authorization.accountId,
-		connectionId: connected.connection.id,
-		decisiveNameserverMatch: authoritative.length > 0 && matchedNameservers.length === authoritative.length,
-		matchedNameservers,
-		providerId: connected.providerId,
-		zone: parse$1(connected.zone)
-	};
-}
-function nameserverSet(nameservers) {
-	return [...new Set(nameservers.map(parse$1))].sort();
-}
-//#endregion
-//#region src/plan/types.ts
-var types_exports = /* @__PURE__ */ __exportAll({
-	Authorization: () => Authorization$1,
-	Operation: () => Operation$1,
-	Receipt: () => Receipt$1,
-	Schema: () => Schema$1,
-	decode: () => decode,
-	decodeReceipt: () => decodeReceipt,
-	encode: () => encode,
-	encodeReceipt: () => encodeReceipt
-});
-const Operation$1 = Schema.TaggedUnion({
-	create: {
-		id: Schema.String,
-		requirement: Schema$6
-	},
-	noop: {
-		id: Schema.String,
-		requirement: Schema$6,
-		ttlDrift: Schema.Boolean
-	},
-	conflict: {
-		existing: Schema.Array(Observed),
-		id: Schema.String,
-		reason: Schema.String,
-		requirement: Schema$6
-	}
-});
-const Schema$1 = Schema.Struct({
-	digest: Schema.String,
-	operations: Schema.Array(Operation$1),
-	providerId: Schema.String,
-	version: Schema.Literal("domainkit.dns-plan.v1"),
-	zone: Schema$5
-});
-const Authorization$1 = Schema.Struct({
-	allowPartial: Schema.Boolean,
-	operationIds: Schema.Array(Schema.String),
-	planDigest: Schema.String,
-	version: Schema.Literal("domainkit.plan-authorization.v1")
-});
-const Receipt$1 = Schema.Struct({
-	appliedAt: Schema.DateFromString,
-	operations: Schema.Array(Schema.Struct({
-		operationId: Schema.String,
-		providerRecordId: Schema.NullOr(Schema.String)
-	})),
-	planDigest: Schema.String,
-	providerId: Schema.String,
-	status: Schema.Literals(["complete", "partial"]),
-	version: Schema.Literal("domainkit.apply-receipt.v1"),
-	zone: Schema$5
-});
-const decode = Effect.fn("DnsPlan.decode")((input) => Schema.decodeUnknownEffect(Schema$1)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
-const encode = Schema.encodeSync(Schema$1);
-const decodeReceipt = Effect.fn("DnsPlan.decodeReceipt")((input) => Schema.decodeUnknownEffect(Receipt$1)(input).pipe(Effect.mapError((cause) => new Error$3({ message: cause.message }))));
-const encodeReceipt = Schema.encodeSync(Receipt$1);
-//#endregion
-//#region src/plan/plan.ts
-var plan_exports = /* @__PURE__ */ __exportAll({
-	AuthorizationError: () => AuthorizationError,
-	ConflictError: () => ConflictError,
-	PartialApplyError: () => PartialApplyError,
-	StaleError: () => StaleError,
-	apply: () => apply$1,
-	authorize: () => authorize$2,
-	create: () => create$1,
-	renderManualInstructions: () => renderManualInstructions,
-	validate: () => validate$1
-});
-const UnsignedPlan$1 = Schema.Struct({
-	operations: Schema.Array(Operation$1),
-	providerId: Schema.String,
-	version: Schema.Literal("domainkit.dns-plan.v1"),
-	zone: Schema$5
-});
-const RequirementDigest = Schema.Struct({ requirement: Schema$6 });
-var ConflictError = class extends Schema.TaggedError()("PlanConflictError", { operationIds: Schema.Array(Schema.String) }) {};
-var AuthorizationError = class extends Schema.TaggedError()("AuthorizationError", { message: Schema.String }) {};
-var StaleError = class extends Schema.TaggedError()("StalePlanError", {
-	approvedPlanDigest: Schema.String,
-	currentPlanDigest: Schema.String
-}) {};
-var PartialApplyError = class extends Schema.TaggedError()("PartialApplyError", {
-	causeTag: Schema.Literals([
-		"CryptoError",
-		"InvalidInputError",
-		"Interrupted",
-		"ProviderError",
-		"StalePlanError"
-	]),
-	failedOperationId: Schema.String,
-	message: Schema.String,
-	receipt: Receipt$1
-}) {};
-/** Builds a deterministic DNS plan through the provider in the Effect environment. */
-const create$1 = Effect.fn("Provisioning.create")(function* (input) {
-	const provider = yield* Service;
-	const zone = yield* decode$4(input.zone);
-	const requirements = (yield* Effect.forEach(input.requirements, decode$5, { concurrency: "unbounded" })).sort(compareRecords);
-	const existing = [...yield* provider.listRecords(zone)].sort(compareRecords);
-	const { operations } = yield* Effect.reduce(requirements, () => ({
-		operations: [],
-		projected: existing
-	}), (state, requirement) => reconcileRequirement(requirement, state.projected).pipe(Effect.map((operation) => ({
-		operations: [...state.operations, operation],
-		projected: operation._tag === "create" ? [...state.projected, operation.requirement].sort(compareRecords) : state.projected
-	}))));
-	const unsigned = {
-		operations,
-		providerId: provider.id,
-		version: "domainkit.dns-plan.v1",
-		zone
-	};
-	return {
-		...unsigned,
-		digest: yield* sha256Encoded(UnsignedPlan$1, unsigned)
-	};
-});
-/** Authorizes all or a selected subset of create operations in a digest-bound plan. */
-const authorize$2 = Effect.fn("Provisioning.authorize")(function* (plan, operationIds, options = {}) {
-	yield* validate$1(plan);
-	const createIds = plan.operations.filter((operation) => operation._tag === "create").map(({ id }) => id);
-	const selected = [...new Set(operationIds ?? createIds)].sort();
-	const unknown = selected.filter((id) => !createIds.includes(id));
-	if (unknown.length > 0) return yield* new AuthorizationError({ message: `Unknown operation IDs: ${unknown.join(", ")}` });
-	if (!options.allowPartial && selected.length !== createIds.length) return yield* new AuthorizationError({ message: "Partial authorization requires allowPartial" });
-	return {
-		allowPartial: options.allowPartial ?? false,
-		operationIds: selected,
-		planDigest: plan.digest,
-		version: "domainkit.plan-authorization.v1"
-	};
-});
-/** Applies approved creates sequentially after full and per-operation revalidation. */
-const apply$1 = Effect.fn("Provisioning.apply")(function* (input) {
-	const { authorization, plan } = input;
-	const provider = yield* Service;
-	yield* validate$1(plan);
-	if (authorization.planDigest !== plan.digest) return yield* new AuthorizationError({ message: "Authorization belongs to a different plan" });
-	if (provider.id !== plan.providerId) return yield* new AuthorizationError({ message: "Provider does not match the approved plan" });
-	const conflicts = plan.operations.filter((operation) => operation._tag === "conflict");
-	if (conflicts.length > 0) return yield* new ConflictError({ operationIds: conflicts.map(({ id }) => id) });
-	const creates = plan.operations.filter(Operation$1.guards.create);
-	const approved = new Set(authorization.operationIds);
-	const unknown = authorization.operationIds.filter((id) => !creates.some((operation) => operation.id === id));
-	if (unknown.length > 0) return yield* new AuthorizationError({ message: `Authorization contains unknown operations: ${unknown.join(", ")}` });
-	if (!authorization.allowPartial && creates.some(({ id }) => !approved.has(id))) return yield* new AuthorizationError({ message: "Authorization does not cover every create operation" });
-	const currentPlan = yield* create$1({
-		requirements: plan.operations.map(({ requirement }) => requirement),
-		zone: plan.zone
-	});
-	if (currentPlan.digest !== plan.digest) return yield* new StaleError({
-		approvedPlanDigest: plan.digest,
-		currentPlanDigest: currentPlan.digest
-	});
-	const operations = [];
-	for (const operation of creates) {
-		if (!approved.has(operation.id)) continue;
-		yield* Effect.gen(function* () {
-			yield* assertStillCreatable(plan, operation);
-			const result = yield* provider.createRecord(plan.zone, operation.requirement);
-			operations.push({
-				operationId: operation.id,
-				providerRecordId: result.providerRecordId
-			});
-		}).pipe(Effect.catch((failure) => operations.length === 0 ? Effect.fail(failure) : makeReceipt$1(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
-			causeTag: failure._tag,
-			failedOperationId: operation.id,
-			message: failureMessage(failure),
-			receipt
-		}))))), Effect.catchCause((cause) => {
-			if (!Cause.hasInterruptsOnly(cause) || operations.length === 0) return Effect.failCause(cause);
-			return makeReceipt$1(input, operations, "partial").pipe(Effect.flatMap((receipt) => Effect.fail(new PartialApplyError({
-				causeTag: "Interrupted",
-				failedOperationId: operation.id,
-				message: "DNS apply was interrupted after confirmed writes",
-				receipt
-			}))));
-		}));
-	}
-	return yield* makeReceipt$1(input, operations, "complete");
-});
-function renderManualInstructions(plan) {
-	return plan.operations.map((operation) => {
-		const record = operation.requirement;
-		const data$2 = Object.entries(data(record)).map(([key, value]) => `${key}=${value}`).join(" ");
-		return `${operation._tag.toUpperCase()} ${record._tag} ${record.name} ${data$2}`.trim();
-	});
-}
-function makeReceipt$1(input, operations, status) {
-	return Clock.currentTimeMillis.pipe(Effect.map((now) => ({
-		appliedAt: new Date(now),
-		operations,
-		planDigest: input.plan.digest,
-		providerId: input.plan.providerId,
-		status,
-		version: "domainkit.apply-receipt.v1",
-		zone: input.plan.zone
-	})));
-}
-function assertStillCreatable(plan, operation) {
-	return create$1({
-		requirements: [operation.requirement],
-		zone: plan.zone
-	}).pipe(Effect.flatMap((currentPlan) => {
-		const currentOperation = currentPlan.operations[0];
-		return currentOperation?._tag === "create" && currentOperation.id === operation.id ? Effect.void : Effect.fail(new StaleError({
-			approvedPlanDigest: plan.digest,
-			currentPlanDigest: currentPlan.digest
-		}));
-	}));
-}
-function reconcileRequirement(requirement, allExisting) {
-	return Effect.gen(function* () {
-		const sameName = allExisting.filter((record) => record.name === requirement.name);
-		const sameSet = sameName.filter((record) => record._tag !== "Opaque" && record._tag === requirement._tag);
-		const exact = sameSet.find((record) => equals(record, requirement));
-		const id = yield* sha256Encoded(RequirementDigest, { requirement });
-		if (exact !== void 0) return {
-			_tag: "noop",
-			id,
-			requirement,
-			ttlDrift: exact.ttl !== requirement.ttl
-		};
-		if (sameName.length > 0 && (requirement._tag === "CNAME" || sameName.some((record) => record._tag === "CNAME"))) return {
-			_tag: "conflict",
-			existing: sameName,
-			id,
-			reason: "CNAME records cannot coexist with other records at the same name",
-			requirement
-		};
-		if (sameSet.length > 0 && (requirement.policy === "exclusive" || sameSet.some(({ policy }) => policy === "exclusive"))) return {
-			_tag: "conflict",
-			existing: sameSet,
-			id,
-			reason: "The exclusive record set already contains incompatible data",
-			requirement
-		};
-		return {
-			_tag: "create",
-			id,
-			requirement
-		};
-	});
-}
-function validate$1(plan) {
-	const unsigned = {
-		operations: plan.operations,
-		providerId: plan.providerId,
-		version: plan.version,
-		zone: plan.zone
-	};
-	return sha256Encoded(UnsignedPlan$1, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new AuthorizationError({ message: "Plan digest does not match its contents" }))));
-}
-function failureMessage(failure) {
-	return failure._tag === "StalePlanError" ? "DNS state changed while applying the approved plan" : failure.message;
-}
-function compareRecords(left, right) {
-	const encode = Schema.encodeSync(Observed);
-	const toJson = Schema.decodeUnknownSync(Schema.Json);
-	const leftJson = stringify(toJson(encode(left)));
-	const rightJson = stringify(toJson(encode(right)));
-	return leftJson < rightJson ? -1 : leftJson > rightJson ? 1 : 0;
-}
-//#endregion
-//#region src/plan/connection-authorization.ts
-var connection_authorization_exports = /* @__PURE__ */ __exportAll({ authorize: () => authorize$1 });
-const authorize$1 = Effect.fn("ConnectionAuthorization.authorize")(function* (input) {
-	const domain = yield* Effect.try({
-		try: () => assertGrant(input.connection, input.authorization, {
-			capability: "dns:write",
-			domain: input.domain,
-			providerId: input.plan.providerId
-		}),
-		catch: (cause) => cause instanceof AuthorizationError$1 || cause instanceof Error$3 ? cause : new AuthorizationError$1({ message: "Connection grant is invalid" })
-	});
-	const authorization = yield* authorize$2(input.plan, input.operationIds, input.allowPartial === void 0 ? {} : { allowPartial: input.allowPartial });
-	const selected = new Set(authorization.operationIds);
-	if (input.plan.operations.filter((operation) => operation._tag === "create" && selected.has(operation.id) && operation.requirement.name !== domain && !operation.requirement.name.endsWith(`.${domain}`)).length > 0) return yield* new AuthorizationError$1({ message: `Plan operations are outside the granted domain ${domain}` });
-	return authorization;
-});
-//#endregion
-//#region src/plan/deletion.ts
-var deletion_exports = /* @__PURE__ */ __exportAll({
-	Authorization: () => Authorization,
-	Error: () => Error$1,
-	Operation: () => Operation,
-	PartialError: () => PartialError,
-	Plan: () => Plan,
-	Receipt: () => Receipt,
-	apply: () => apply,
-	authorize: () => authorize,
-	create: () => create,
-	validate: () => validate
-});
-const Operation = Schema.Struct({
-	id: Schema.String,
-	providerRecordId: Schema.String,
-	record: Schema$6
-});
-const UnsignedPlan = Schema.Struct({
-	createdAt: Schema.DateFromString,
-	expiresAt: Schema.DateFromString,
-	operations: Schema.Array(Operation),
-	providerId: Schema.String,
-	sourcePlanDigest: Schema.String,
-	version: Schema.Literal("domainkit.deletion-plan.v1"),
-	zone: Schema$5
-});
-const Plan = Schema.Struct({
-	...UnsignedPlan.fields,
-	digest: Schema.String
-});
-const Authorization = Schema.Struct({
-	operationIds: Schema.Array(Schema.String),
-	planDigest: Schema.String,
-	version: Schema.Literal("domainkit.deletion-authorization.v1")
-});
-const Receipt = Schema.Struct({
-	deletedAt: Schema.DateFromString,
-	operations: Schema.Array(Schema.Struct({
-		operationId: Schema.String,
-		providerRecordId: Schema.String
-	})),
-	planDigest: Schema.String,
-	providerId: Schema.String,
-	status: Schema.Literals(["complete", "partial"]),
-	version: Schema.Literal("domainkit.deletion-receipt.v1"),
-	zone: Schema$5
-});
-var Error$1 = class extends Schema.TaggedError()("UnsafeDeletionError", {
-	message: Schema.String,
-	operationId: Schema.optionalKey(Schema.String)
-}) {};
-var PartialError = class extends Schema.TaggedError()("PartialDeletionError", {
-	failedOperationId: Schema.String,
-	message: Schema.String,
-	receipt: Receipt
-}) {};
-/** Build a fresh deletion plan only from records proven by a prior create receipt. */
-const create = Effect.fn("Deletion.create")(function* (input) {
-	const provider = yield* Service;
-	yield* validate$1(input.plan);
-	if (input.receipt.planDigest !== input.plan.digest || input.receipt.providerId !== input.plan.providerId || input.receipt.zone !== input.plan.zone) return yield* new Error$1({ message: "Create receipt does not belong to the source plan" });
-	if (provider.id !== input.plan.providerId) return yield* new Error$1({ message: "Provider does not match the source receipt" });
-	const operations = yield* Effect.forEach(input.receipt.operations, (applied) => Effect.gen(function* () {
-		const source = input.plan.operations.find((operation) => operation._tag === "create" && operation.id === applied.operationId);
-		if (source === void 0 || source._tag !== "create") return yield* new Error$1({
-			message: "Receipt operation is not a created source record",
-			operationId: applied.operationId
-		});
-		if (applied.providerRecordId === null) return yield* new Error$1({
-			message: "Provider record ID is required for safe deletion",
-			operationId: applied.operationId
-		});
-		yield* assertExact(provider, input.plan.zone, applied.providerRecordId, source.requirement, source.id);
-		return {
-			id: source.id,
-			providerRecordId: applied.providerRecordId,
-			record: source.requirement
-		};
-	}));
-	const now = yield* Clock.currentTimeMillis;
-	const unsigned = {
-		createdAt: new Date(now),
-		expiresAt: new Date(now + (input.ttlMs ?? 9e5)),
-		operations,
-		providerId: input.plan.providerId,
-		sourcePlanDigest: input.plan.digest,
-		version: "domainkit.deletion-plan.v1",
-		zone: input.plan.zone
-	};
-	return {
-		...unsigned,
-		digest: yield* sha256Encoded(UnsignedPlan, unsigned)
-	};
-});
-/** Produce a separate digest-bound consent artifact for destructive operations. */
-const authorize = Effect.fn("Deletion.authorize")(function* (plan, operationIds) {
-	yield* validate(plan);
-	const selected = [...new Set(operationIds ?? plan.operations.map(({ id }) => id))].sort();
-	const unknown = selected.filter((id) => !plan.operations.some((operation) => operation.id === id));
-	if (unknown.length > 0) return yield* new Error$1({ message: `Unknown deletion operation IDs: ${unknown.join(", ")}` });
-	return {
-		operationIds: selected,
-		planDigest: plan.digest,
-		version: "domainkit.deletion-authorization.v1"
-	};
-});
-/** Re-read every approved record before the first delete, then delete by provider record ID. */
-const apply = Effect.fn("Deletion.apply")(function* (input) {
-	const provider = yield* Service;
-	yield* validate(input.plan);
-	if (input.authorization.planDigest !== input.plan.digest) return yield* new Error$1({ message: "Deletion authorization belongs to a different plan" });
-	if (provider.id !== input.plan.providerId) return yield* new Error$1({ message: "Provider does not match the deletion plan" });
-	const now = yield* Clock.currentTimeMillis;
-	if (input.plan.expiresAt <= new Date(now)) return yield* new Error$1({ message: "Deletion plan has expired" });
-	const selected = input.plan.operations.filter(({ id }) => input.authorization.operationIds.includes(id));
-	if (selected.length !== input.authorization.operationIds.length) return yield* new Error$1({ message: "Deletion authorization contains unknown operations" });
-	const previouslyDeleted = yield* validatePriorReceipt(input.plan, input.priorReceipt);
-	const completedIds = new Set(previouslyDeleted.map(({ operationId }) => operationId));
-	if (previouslyDeleted.some(({ operationId }) => !input.authorization.operationIds.includes(operationId))) return yield* new Error$1({ message: "Prior receipt contains an unauthorized operation" });
-	const remaining = selected.filter(({ id }) => !completedIds.has(id));
-	yield* Effect.forEach(remaining, (operation) => assertExact(provider, input.plan.zone, operation.providerRecordId, operation.record, operation.id));
-	const deleted = [...previouslyDeleted];
-	for (const operation of remaining) {
-		const failure = yield* Effect.gen(function* () {
-			yield* assertExact(provider, input.plan.zone, operation.providerRecordId, operation.record, operation.id);
-			yield* provider.deleteRecord(input.plan.zone, operation.providerRecordId);
-			deleted.push({
-				operationId: operation.id,
-				providerRecordId: operation.providerRecordId
-			});
-		}).pipe(Effect.match({
-			onFailure: (cause) => cause,
-			onSuccess: () => null
-		}));
-		if (failure !== null) {
-			if (deleted.length === 0) return yield* failure;
-			return yield* new PartialError({
-				failedOperationId: operation.id,
-				message: failure.message,
-				receipt: yield* makeReceipt(input.plan, deleted, "partial")
-			});
-		}
-	}
-	return yield* makeReceipt(input.plan, deleted, "complete");
-});
-function validate(plan) {
-	const unsigned = {
-		createdAt: plan.createdAt,
-		expiresAt: plan.expiresAt,
-		operations: plan.operations,
-		providerId: plan.providerId,
-		sourcePlanDigest: plan.sourcePlanDigest,
-		version: plan.version,
-		zone: plan.zone
-	};
-	return sha256Encoded(UnsignedPlan, unsigned).pipe(Effect.flatMap((digest) => digest === plan.digest ? Effect.void : Effect.fail(new Error$1({ message: "Deletion plan digest does not match its contents" }))));
-}
-function validatePriorReceipt(plan, receipt) {
-	if (receipt === void 0) return Effect.succeed([]);
-	if (receipt.planDigest !== plan.digest || receipt.providerId !== plan.providerId || receipt.zone !== plan.zone || receipt.status !== "partial") return Effect.fail(new Error$1({ message: "Prior receipt does not belong to this deletion plan" }));
-	for (const completed of receipt.operations) {
-		const operation = plan.operations.find(({ id }) => id === completed.operationId);
-		if (operation === void 0 || operation.providerRecordId !== completed.providerRecordId) return Effect.fail(new Error$1({ message: "Prior receipt operation does not match the deletion plan" }));
-	}
-	return Effect.succeed([...receipt.operations]);
-}
-function assertExact(provider, zone, providerRecordId, expected, operationId) {
-	return provider.getRecord(zone, providerRecordId).pipe(Effect.flatMap((observed) => observed !== null && observed._tag !== "Opaque" && equals(observed, expected) ? Effect.void : Effect.fail(new Error$1({
-		message: observed === null ? "Created record no longer exists" : "Created record content no longer matches its receipt",
-		operationId
-	}))));
-}
-function makeReceipt(plan, operations, status) {
-	return Clock.currentTimeMillis.pipe(Effect.map((now) => ({
-		deletedAt: new Date(now),
-		operations,
-		planDigest: plan.digest,
-		providerId: plan.providerId,
-		status,
-		version: "domainkit.deletion-receipt.v1",
-		zone: plan.zone
-	})));
-}
-//#endregion
-//#region src/verification/dns-data.ts
-var dns_data_exports = /* @__PURE__ */ __exportAll({ parse: () => parse });
-const CanonicalAddress = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
-	decode: (value) => value.trim().toLowerCase(),
-	encode: (value) => value
-})));
-const CanonicalDomain = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
-	decode: (value, options) => Effect.try({
-		try: () => parse$1(value).toString(),
-		catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
-	}),
-	encode: (value) => Effect.succeed(value)
-})));
-const CanonicalMx = tokenizedDomain(2, 1);
-const CanonicalSrv = tokenizedDomain(4, 3);
-const CanonicalTxt = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
-	decode: (value) => {
-		const trimmed = value.trim();
-		const chunks = [...trimmed.matchAll(/"((?:\\.|[^"])*)"/g)];
-		return chunks.length === 0 ? trimmed : chunks.map((match) => (match[1] ?? "").replace(/\\"/g, "\"").replace(/\\\\/g, "\\")).join("");
-	},
-	encode: (value) => value
-})));
-const CanonicalCaa = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
-	decode: (value) => value.trim().replace(/\s+"([\s\S]*)"$/, " $1"),
-	encode: (value) => value
-})));
-function parse(type, input) {
-	const schema = (() => {
-		switch (type) {
-			case "A":
-			case "AAAA": return CanonicalAddress;
-			case "CNAME":
-			case "NS": return CanonicalDomain;
-			case "MX": return CanonicalMx;
-			case "SRV": return CanonicalSrv;
-			case "TXT": return CanonicalTxt;
-			case "CAA": return CanonicalCaa;
-		}
-	})();
-	try {
-		return Schema.decodeUnknownSync(schema)(input);
-	} catch (cause) {
-		throw new Error$3({ message: cause instanceof Error ? cause.message : String(cause) });
-	}
-}
-function tokenizedDomain(length, domainIndex) {
-	return Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transformOrFail({
-		decode: (value, options) => Effect.try({
-			try: () => {
-				const parts = value.trim().split(/\s+/);
-				if (parts.length !== length) throw new Error("DNS record data has an invalid field count");
-				const domain = parts[domainIndex];
-				if (domain === void 0) throw new Error("DNS record target is missing");
-				parts[domainIndex] = parse$1(domain);
-				return parts.join(" ");
-			},
-			catch: (cause) => new SchemaIssue.InvalidValue({ message: cause instanceof Error ? cause.message : String(cause) }, value, options)
-		}),
-		encode: (value) => Effect.succeed(value)
-	})));
-}
-//#endregion
-//#region src/verification/doh.ts
-var doh_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer$1,
-	make: () => make$1,
-	toAsync: () => toAsync$1
-});
-function make$1(options) {
-	const fetch = options.fetch ?? globalThis.fetch;
-	const timeoutMs = options.timeoutMs ?? 5e3;
-	return { resolve: Effect.fn("DnsOverHttps.resolve")((query) => Effect.tryPromise({
-		try: (effectSignal) => request({
-			effectSignal,
-			fetch,
-			query,
-			timeoutMs,
-			endpoint: options.endpoint
-		}),
-		catch: (cause) => cause instanceof Error$5 ? cause : new Error$5({
-			cause,
-			message: cause instanceof Error ? cause.message : "DNS resolution failed",
-			reason: "transport"
-		})
-	}).pipe(Effect.flatMap((message) => decodeResolution(query, message)))) };
-}
-const layer$1 = (options) => Layer.succeed(Service$5, make$1(options));
-const toAsync$1 = (options) => toAsync$2(make$1(options));
-function decodeResolution(query, message) {
-	return Effect.try({
-		try: () => DnsPacket.decode(message),
-		catch: (cause) => new Error$5({
-			cause,
-			message: "DoH returned an invalid DNS message",
-			reason: "response"
-		})
-	}).pipe(Effect.flatMap((packet) => validatePacket(query, packet)), Effect.flatMap(decodePacket));
-}
-function decodePacket(packet) {
-	if (packet.rcode === "NXDOMAIN") return Effect.succeed({ _tag: "nodata" });
-	if (packet.rcode !== "NOERROR") return Effect.fail(new Error$5({
-		message: `DNS resolver returned ${packet.rcode ?? "an unknown response code"}`,
-		reason: "response"
-	}));
-	if (packet.answers === void 0 || packet.answers.length === 0) return Effect.succeed({ _tag: "nodata" });
-	return Effect.forEach(packet.answers, decodeAnswer, { concurrency: "unbounded" }).pipe(Effect.map((answers) => {
-		const supportedAnswers = answers.filter((answer) => answer !== null);
-		return supportedAnswers.length === 0 ? { _tag: "nodata" } : {
-			_tag: "answer",
-			answers: supportedAnswers
-		};
-	}));
-}
-function validatePacket(query, packet) {
-	return Effect.try({
-		try: () => {
-			if (packet.type !== "response") throw new Error("DoH returned a DNS query");
-			if (packet.id !== 0) throw new Error("DoH response used an unexpected message ID");
-			if (packet.flag_tc) throw new Error("DoH returned a truncated DNS response");
-			const questions = packet.questions ?? [];
-			if (questions.length !== 1) throw new Error("DoH returned an unexpected question count");
-			const question = questions[0];
-			if (question === void 0) throw new Error("DoH response omitted the DNS question");
-			if (question.class !== "IN" || question.type !== query.type || parse$1(question.name) !== query.name) throw new Error("DoH response did not match the DNS question");
-			return packet;
-		},
-		catch: (cause) => new Error$5({
-			cause,
-			message: cause instanceof Error ? cause.message : "DoH returned an invalid DNS response",
-			reason: "response"
-		})
-	});
-}
-function decodeAnswer(answer) {
-	return Effect.gen(function* () {
-		if (answer.class !== "IN") return null;
-		const decoded = yield* Effect.try({
-			try: () => answerData(answer),
-			catch: (cause) => new Error$5({
-				cause,
-				message: "DoH returned invalid DNS record data",
-				reason: "response"
-			})
-		});
-		if (decoded === void 0) return null;
-		const name = yield* decode$4(answer.name);
-		const data = yield* Effect.try({
-			try: () => parse(decoded.type, decoded.data),
-			catch: (cause) => new Error$5({
-				cause,
-				message: "DoH returned invalid DNS record data",
-				reason: "response"
-			})
-		});
-		if (answer.ttl === void 0) return yield* new Error$5({
-			message: "DoH response omitted the DNS record TTL",
-			reason: "response"
-		});
-		return {
-			data,
-			name,
-			ttl: answer.ttl,
-			type: decoded.type
-		};
-	}).pipe(Effect.mapError((cause) => cause instanceof Error$5 ? cause : new Error$5({
-		cause,
-		message: cause.message,
-		reason: "response"
-	})));
-}
-function answerData(answer) {
-	switch (answer.type) {
-		case "A":
-		case "AAAA":
-		case "CNAME":
-		case "NS": return {
-			data: answer.data,
-			type: answer.type
-		};
-		case "CAA": return {
-			data: `${answer.data.flags ?? 0} ${answer.data.tag} ${answer.data.value}`,
-			type: answer.type
-		};
-		case "MX": return {
-			data: `${requiredNumber(answer.data.preference, "MX preference")} ${answer.data.exchange}`,
-			type: answer.type
-		};
-		case "SRV": return {
-			data: [
-				requiredNumber(answer.data.priority, "SRV priority"),
-				requiredNumber(answer.data.weight, "SRV weight"),
-				requiredNumber(answer.data.port, "SRV port"),
-				answer.data.target
-			].join(" "),
-			type: answer.type
-		};
-		case "TXT": return {
-			data: decodeTxt(answer.data),
-			type: answer.type
-		};
-		default: return;
-	}
-}
-function decodeTxt(data) {
-	const encoded = (Array.isArray(data) ? data : [data]).map((chunk) => typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
-	const length = encoded.reduce((total, chunk) => total + chunk.length, 0);
-	const joined = new Uint8Array(length);
-	let offset = 0;
-	for (const chunk of encoded) {
-		joined.set(chunk, offset);
-		offset += chunk.length;
-	}
-	return new TextDecoder("utf-8", { fatal: true }).decode(joined);
-}
-function requiredNumber(value, field) {
-	if (value === void 0) throw new Error(`DoH response omitted ${field}`);
-	return value;
-}
-async function request(input) {
-	const controller = new AbortController();
-	let timedOut = false;
-	const abortFromEffect = () => controller.abort(input.effectSignal.reason);
-	const abortFromHost = () => controller.abort(input.query.signal?.reason);
-	input.effectSignal.addEventListener("abort", abortFromEffect, { once: true });
-	input.query.signal?.addEventListener("abort", abortFromHost, { once: true });
-	const timer = setTimeout(() => {
-		timedOut = true;
-		controller.abort(/* @__PURE__ */ new Error("DNS resolution timed out"));
-	}, input.timeoutMs);
-	try {
-		const query = Uint8Array.from(DnsPacket.encode({
-			flags: DnsPacket.RECURSION_DESIRED,
-			id: 0,
-			questions: [{
-				name: input.query.name,
-				type: input.query.type
-			}],
-			type: "query"
-		}));
-		const response = await input.fetch(new URL(input.endpoint), {
-			body: query,
-			headers: {
-				accept: "application/dns-message",
-				"content-type": "application/dns-message"
-			},
-			method: "POST",
-			signal: controller.signal
-		});
-		if (!response.ok) throw new Error$5({
-			message: `DoH returned HTTP ${response.status}`,
-			reason: "transport"
-		});
-		const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-		if (contentType !== "application/dns-message") throw new Error$5({
-			message: `DoH returned unsupported content type ${contentType ?? "<missing>"}`,
-			reason: "response"
-		});
-		return new Uint8Array(await response.arrayBuffer());
-	} catch (cause) {
-		if (timedOut) throw new Error$5({
-			message: "DNS query timed out",
-			reason: "timeout"
-		});
-		throw cause;
-	} finally {
-		clearTimeout(timer);
-		input.effectSignal.removeEventListener("abort", abortFromEffect);
-		input.query.signal?.removeEventListener("abort", abortFromHost);
-	}
-}
-//#endregion
-//#region src/verification/cloudflare-doh.ts
-var cloudflare_doh_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer,
-	make: () => make,
-	toAsync: () => toAsync
-});
-const endpoint = "https://cloudflare-dns.com/dns-query";
-function make(options = {}) {
-	return make$1({
-		...options,
-		endpoint: options.endpoint ?? endpoint
-	});
-}
-const layer = (options = {}) => Layer.succeed(Service$5, make(options));
-const toAsync = (options = {}) => toAsync$2(make(options));
-//#endregion
-//#region src/verification/verify.ts
-var verify_exports = /* @__PURE__ */ __exportAll({
-	ProviderObservation: () => ProviderObservation,
-	PublicDnsObservation: () => PublicDnsObservation,
-	Result: () => Result,
-	record: () => record
-});
-const ProviderObservation = Schema.TaggedUnion({
-	match: {},
-	missing: {},
-	mismatch: { records: Schema.Array(Schema$6) },
-	failure: { message: Schema.String }
-});
-const PublicDnsObservation = Schema.TaggedUnion({
-	propagated: {},
-	missing: {},
-	mismatch: { answers: Schema.Array(Schema.String) },
-	timeout: {},
-	failure: { message: Schema.String }
-});
-const Result = Schema.Struct({
-	provider: ProviderObservation,
-	publicDns: PublicDnsObservation,
-	status: Schema.Literals([
-		"verified",
-		"pending",
-		"mismatch",
-		"unavailable"
-	])
-});
-const record = Effect.fn("Verification.record")(function* (input) {
-	const provider = yield* Service;
-	const resolver = yield* Service$5;
-	const [providerObservation, publicDns] = yield* Effect.all([observeProvider(provider, input.zone, input.record).pipe(Effect.catch((failure) => Effect.succeed({
-		_tag: "failure",
-		message: failure.message
-	}))), resolver.resolve({
-		name: input.record.name,
-		type: input.record._tag
-	}).pipe(Effect.match({
-		onFailure: (failure) => failure.reason === "timeout" ? { _tag: "timeout" } : {
-			_tag: "failure",
-			message: failure.message
-		},
-		onSuccess: (resolution) => observePublicDns(input.record, resolution)
-	}))], { concurrency: "unbounded" });
-	return {
-		provider: providerObservation,
-		publicDns,
-		status: providerObservation._tag === "match" && publicDns._tag === "propagated" ? "verified" : providerObservation._tag === "failure" || publicDns._tag === "failure" || publicDns._tag === "timeout" ? "unavailable" : providerObservation._tag === "mismatch" || publicDns._tag === "mismatch" ? "mismatch" : "pending"
-	};
-});
-function observeProvider(provider, zone, requirement) {
-	return provider.listRecords(zone).pipe(Effect.map((records) => {
-		if (records.some((existing) => existing._tag !== "Opaque" && equals(existing, requirement))) return { _tag: "match" };
-		const sameSet = records.filter((existing) => existing._tag !== "Opaque" && existing.name === requirement.name && existing._tag === requirement._tag);
-		return sameSet.length === 0 ? { _tag: "missing" } : {
-			_tag: "mismatch",
-			records: sameSet
-		};
-	}));
-}
-function observePublicDns(requirement, resolution) {
-	if (resolution._tag === "nodata") return { _tag: "missing" };
-	const expected = parse(requirement._tag, recordValue(requirement));
-	return resolution.answers.some((answer) => answer.name === requirement.name && answer.type === requirement._tag && parse(answer.type, answer.data) === expected) ? { _tag: "propagated" } : {
-		_tag: "mismatch",
-		answers: resolution.answers.map(({ data }) => data)
-	};
-}
-function recordValue(requirement) {
-	const data$1 = data(requirement);
-	switch (requirement._tag) {
-		case "A":
-		case "AAAA": return String(data$1.address);
-		case "CNAME":
-		case "NS": return String(data$1.target);
-		case "TXT": return String(data$1.value);
-		case "MX": return `${data$1.priority} ${data$1.exchange}`;
-		case "CAA": return `${data$1.flags} ${data$1.tag} ${data$1.value}`;
-		case "SRV": return `${data$1.priority} ${data$1.weight} ${data$1.port} ${data$1.target}`;
-	}
-}
-//#endregion
-export { encode$1 as $, decodeReceipt as A, decode$1 as B, plan_exports as C, Receipt$1 as D, Operation$1 as E, zones_exports as F, refresh as G, begin as H, connect as I, webCryptoLayer as J, revoke as K, token_exports as L, encodeReceipt as M, types_exports as N, Schema$1 as O, selection_exports as P, decode$2 as Q, Method as R, create$1 as S, Authorization$1 as T, complete as U, manifest_exports as V, oauth_exports as W, Schema$3 as X, Capability as Y, authorization_exports as Z, deletion_exports as _, doh_exports as a, Grant as at, apply$1 as b, Authorization as c, connection_exports as ct, PartialError as d, version as dt, Error$2 as et, Plan as f, create as g, authorize as h, toAsync as i, AuthorizationError$1 as it, encode as j, decode as k, Error$1 as l, decode$3 as lt, apply as m, verify_exports as n, detach as nt, toAsync$1 as o, Schema$4 as ot, Receipt as p, canonical_json_exports as q, cloudflare_doh_exports as r, updateGrant as rt, dns_data_exports as s, assertGrant as st, record as t, connection_lifecycle_exports as tt, Operation as u, encode$2 as ut, authorize$1 as v, renderManualInstructions as w, authorize$2 as x, connection_authorization_exports as y, Schema$2 as z };
-
-//# sourceMappingURL=verify-BjrR_4NF.mjs.map